ECS with ALB integration in AWS - Commands & Configuration

Introduction

When you want to run your app in containers on AWS and make it reachable from the internet, you need a way to balance traffic to your containers. ECS with ALB integration lets you run containers and automatically distribute incoming web traffic to them safely and efficiently.

When you want to run multiple copies of your app in containers and share incoming web traffic between them.

When you want AWS to automatically check if your containers are healthy and only send traffic to healthy ones.

When you want to use a single web address to reach your app even if containers move or restart.

When you want to scale your app containers up or down based on demand without changing how users connect.

When you want to separate your app traffic from other services using a load balancer.

Config File - ecs-alb-task-def.json

ecs-alb-task-def.json

{
  "family": "my-app-task",
  "networkMode": "awsvpc",
  "containerDefinitions": [
    {
      "name": "my-app-container",
      "image": "nginx:latest",
      "portMappings": [
        {
          "containerPort": 80,
          "protocol": "tcp"
        }
      ],
      "essential": true
    }
  ],
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "256",
  "memory": "512"
}

This JSON file defines the ECS task that runs your container. It sets the container image to nginx, exposes port 80, and uses Fargate with awsvpc networking for easy integration with the Application Load Balancer (ALB).

Commands

This command registers the task definition in ECS using the JSON file. It tells ECS how to run your container with the right settings.

Terminal

aws ecs register-task-definition --cli-input-json file://ecs-alb-task-def.json

Expected Output

{

    "taskDefinition": {

        "taskDefinitionArn": "arn:aws:ecs:us-east-1:123456789012:task-definition/my-app-task:1",

        "family": "my-app-task",

        "revision": 1,

        "status": "ACTIVE"

    }

}

→

--cli-input-json - Specifies the JSON file with task definition details

This command creates an Application Load Balancer (ALB) in the specified subnets with the given security group to control access.

Terminal

aws elbv2 create-load-balancer --name my-app-alb --subnets subnet-abc12345 subnet-def67890 --security-groups sg-0123456789abcdef0

Expected Output

{

    "LoadBalancers": [

        {

            "LoadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-app-alb/50dc6c495c0c9188",

            "DNSName": "my-app-alb-1234567890.us-east-1.elb.amazonaws.com",

            "State": {"Code": "provisioning"}

        }

    ]

}

→

--name - Sets the name of the load balancer

→

--subnets - Specifies the subnets where the ALB will be available

→

--security-groups - Assigns security groups to control traffic

This command creates a target group that will hold the ECS tasks (containers) to receive traffic from the ALB on port 80.

Terminal

aws elbv2 create-target-group --name my-app-tg --protocol HTTP --port 80 --vpc-id vpc-0abc123def456ghij

Expected Output

{

    "TargetGroups": [

        {

            "TargetGroupArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/my-app-tg/6d0ecf831eec9f09",

            "Protocol": "HTTP",

            "Port": 80,

            "VpcId": "vpc-0abc123def456ghij"

        }

    ]

}

→

--name - Names the target group

→

--protocol - Sets the protocol for traffic

→

--port - Sets the port for traffic

→

--vpc-id - Specifies the VPC where the target group lives

This command creates a listener on the ALB that listens on port 80 and forwards incoming traffic to the target group of ECS tasks.

Terminal

aws elbv2 create-listener --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-app-alb/50dc6c495c0c9188 --protocol HTTP --port 80 --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/my-app-tg/6d0ecf831eec9f09

Expected Output

{

    "Listeners": [

        {

            "ListenerArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-app-alb/50dc6c495c0c9188/9f1b2c3d4e5f6g7h",

            "Port": 80,

            "Protocol": "HTTP"

        }

    ]

}

→

--load-balancer-arn - Specifies which ALB to attach the listener to

→

--protocol - Sets the protocol the listener uses

→

--port - Sets the port the listener listens on

→

--default-actions - Defines what the listener does with incoming traffic

This command creates an ECS service that runs two copies of your task on Fargate, connects them to the ALB target group, and places them in the specified subnets with public IPs.

Terminal

aws ecs create-service --cluster default --service-name my-app-service --task-definition my-app-task --desired-count 2 --launch-type FARGATE --network-configuration "awsvpcConfiguration={subnets=[subnet-abc12345,subnet-def67890],securityGroups=[sg-0123456789abcdef0],assignPublicIp=ENABLED}" --load-balancers "targetGroupArn=arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/my-app-tg/6d0ecf831eec9f09,containerName=my-app-container,containerPort=80"

Expected Output

{

    "service": {

        "serviceName": "my-app-service",

        "clusterArn": "arn:aws:ecs:us-east-1:123456789012:cluster/default",

        "status": "ACTIVE",

        "desiredCount": 2

    }

}

→

--desired-count - Sets how many task copies to run

→

--network-configuration - Defines networking details for the tasks

→

--load-balancers - Connects the service to the ALB target group

Key Concept

If you remember nothing else from this pattern, remember: the ALB routes web traffic to your ECS containers through a target group, keeping your app reachable and balanced.

Common Mistakes

Not specifying the correct subnets or security groups when creating the ALB or ECS service

The ALB or ECS tasks won't be reachable or will have network errors if subnets or security groups are wrong.

Always use subnets in your VPC that allow internet traffic and security groups that permit HTTP traffic on port 80.

Forgetting to set the container port in the ECS task definition to match the ALB target group port

The ALB won't be able to forward traffic correctly if ports don't match, causing connection failures.

Ensure the container port in the task definition matches the port defined in the target group and listener.

Not assigning public IPs to ECS tasks when using public subnets

Tasks won't have internet access or be reachable from the ALB if they lack public IPs in public subnets.

Set assignPublicIp=ENABLED in the network configuration for tasks in public subnets.

Summary

Register an ECS task definition describing your container and port.

Create an Application Load Balancer in the right subnets with security groups.

Create a target group for the ALB to send traffic to your containers.

Create a listener on the ALB to forward HTTP traffic to the target group.

Create an ECS service that runs your tasks and connects them to the ALB target group.

Practice

1. What is the main purpose of integrating an Application Load Balancer (ALB) with Amazon ECS?

easy

A. To distribute incoming web traffic evenly across multiple container tasks

B. To store container images securely

C. To monitor CPU usage of ECS tasks

D. To create virtual private clouds automatically

Solution

1. Step 1: Understand ALB role in ECS

   ALB is designed to balance incoming traffic to multiple targets, such as ECS tasks, to ensure reliability and scalability.

2. Step 2: Identify the correct purpose

   Among the options, only distributing web traffic evenly matches ALB's function in ECS.

3. Final Answer:

   To distribute incoming web traffic evenly across multiple container tasks -> Option A

4. Quick Check:

   ALB balances traffic = C [OK]

Hint: ALB balances traffic to containers, not stores or monitors [OK]

Common Mistakes:

• Confusing ALB with container image storage
• Thinking ALB monitors CPU usage
• Assuming ALB creates VPCs

2. Which ECS launch type and network mode combination is recommended for simple networking and security when using ALB?

easy

A. EC2 launch type with none network mode

B. EC2 launch type with bridge network mode

C. Fargate launch type with host network mode

D. Fargate launch type with awsvpc network mode

Solution

1. Step 1: Recall recommended ECS and network mode

   Fargate with awsvpc mode provides each task with its own network interface, simplifying networking and security.

2. Step 2: Match options to recommendation

   Only Fargate launch type with awsvpc network mode matches the recommended combination for ALB integration.

3. Final Answer:

   Fargate launch type with awsvpc network mode -> Option D

4. Quick Check:

   Fargate + awsvpc = A [OK]

Hint: Fargate + awsvpc = simple networking with ALB [OK]

Common Mistakes:

• Choosing EC2 launch type instead of Fargate
• Using bridge or host network modes with Fargate
• Selecting none network mode which disables networking

3. Given this ECS service configuration snippet, what will happen when the ALB receives HTTP requests?

{
  "loadBalancers": [{
    "targetGroupArn": "arn:aws:elasticloadbalancing:...",
    "containerName": "webapp",
    "containerPort": 80
  }],
  "launchType": "FARGATE",
  "networkConfiguration": {
    "awsvpcConfiguration": {
      "subnets": ["subnet-12345"],
      "assignPublicIp": "ENABLED"
    }
  }
}

medium

A. ALB forwards requests to the webapp container on port 80 in each task

B. ALB blocks all HTTP requests due to missing security group

C. ALB forwards requests to port 443 by default

D. ALB cannot route because containerPort is missing

Solution

1. Step 1: Analyze load balancer target settings

   The ALB targets the container named "webapp" on port 80, so it will forward HTTP requests there.

2. Step 2: Check network configuration

   Fargate with awsvpc and public IP enabled allows tasks to receive traffic from ALB.

3. Final Answer:

   ALB forwards requests to the webapp container on port 80 in each task -> Option A

4. Quick Check:

   ALB targets container port 80 = B [OK]

Hint: ALB forwards to specified containerPort, not default 443 [OK]

Common Mistakes:

• Assuming ALB blocks traffic without explicit security group mention
• Thinking ALB defaults to port 443
• Missing containerPort causes routing failure

4. You deployed an ECS service with ALB integration but the ALB shows no healthy targets. What is the most likely cause?

medium

A. The ECS cluster has no EC2 instances running

B. The ALB listener is missing a rule for HTTPS traffic

C. The ECS tasks are not registering with the target group due to incorrect container port mapping

D. The ALB is in a different AWS region than the ECS service

Solution

1. Step 1: Understand why ALB shows no healthy targets

   ALB health checks fail if ECS tasks do not register correctly, often due to wrong container port mapping.

2. Step 2: Evaluate other options

   Listener rules missing HTTPS won't cause no healthy targets; ECS Fargate doesn't need EC2 instances; ALB and ECS must be in same region, but this is less common cause.

3. Final Answer:

   The ECS tasks are not registering with the target group due to incorrect container port mapping -> Option C

4. Quick Check:

   Incorrect port mapping blocks target registration = A [OK]

Hint: Check container port matches target group port for healthy targets [OK]

Common Mistakes:

• Assuming missing HTTPS rule causes no healthy targets
• Thinking ECS Fargate needs EC2 instances
• Ignoring region mismatch issues

5. You want to deploy a highly available ECS service behind an ALB that automatically scales with traffic. Which combination of settings ensures this best practice?

hard

A. Use EC2 launch type with none mode, ALB with health checks disabled, and ECS service with fixed task count

B. Use Fargate launch type with awsvpc mode, ALB with target group health checks, and ECS service auto scaling

C. Use Fargate launch type with host mode, ALB with fixed target group size, and no ECS scaling

D. Use EC2 launch type with bridge mode, ALB without health checks, and manual ECS task scaling

Solution

1. Step 1: Identify best ECS launch and network mode for availability

   Fargate with awsvpc mode simplifies networking and security, ideal for high availability.

2. Step 2: Confirm ALB and ECS scaling features

   ALB target group health checks ensure traffic only goes to healthy tasks; ECS service auto scaling adjusts task count with traffic.

3. Step 3: Evaluate other options

   Other options lack health checks or auto scaling, reducing availability and scalability.

4. Final Answer:

   Use Fargate launch type with awsvpc mode, ALB with target group health checks, and ECS service auto scaling -> Option B

5. Quick Check:

   Fargate + awsvpc + ALB health checks + auto scaling = D [OK]

Hint: Combine Fargate, awsvpc, ALB health checks, and auto scaling [OK]

Common Mistakes:

• Skipping ALB health checks
• Using manual scaling instead of auto scaling
• Choosing EC2 with bridge or none network modes